In an NGN network, a service layer is separated from a transport layer. The transport layer is based on packet technologies and optical technologies while the service layer provides many kinds of multimedia services. Much attention will be paid as how to guarantee security and Quality of Service (QoS) of a service in an NGN network since an NGN network is based on Internet Protocol (IP) packet technologies. Moreover, a firewall function, which is the most important and used most widely network security technology, will still be used for solving the security problem of services in an NGN.
At present, firewall products are mainly categorized into two species, that is, Packet-filter-based Firewall and Application-proxy-based Firewall. The Packet-filter-based Firewall operates in the transport layer while the Application-proxy-based Firewall operates in the application layer.
The Packet-filter-based Firewall further includes the following four working modes.
(1) Static Packet Filtering Firewall
A Static packet filtering firewall implements a static packet filtering based on information of a data packet head. The Static packet filtering firewall makes a decision of admission or rejection of each data packet received. The Static packet filtering firewall examines each data packet so as to determine whether the packet matches a certain filtering rule. The filtering rule is based on information of a packet head that may be provided to an IP forwarding process. The following contents of a packet head are mainly to be examined in the packet filtering process: an IP source address, an IP destination address, type of protocol (a Transmission Control Protocol (TCP) packet, a User Datagram Protocol (UDP) packet or an Internet Control Message Protocol (ICMP) packet), a destination port of a TCP or UDP packet, a source port of a TCP or UDP packet, type of an ICMP message, an ACK bit of a TCP packet head.
The Static packet filtering firewall has the following disadvantages: it is hard to maintain a Static packet filtering firewall; the Static packet filtering firewall cannot prevent a spoofing attack of a hacker effectively; the Static packet filtering firewall does not support filtering in the application layer and cannot prevent a data-driven attack; and the Static packet filtering firewall cannot provide a comprehensive control of an information flowing in the network. Therefore, security of the Static packet filter is poor.
(2) Dynamic Packet Filtering Firewall
A method of setting a packet filtering rule dynamically is adopted to avoid the problems in the Static packet filtering. In the Dynamic packet filtering, a port is opened only when a user sends a request and is closed after the service is committed. Thus, the possibility of suffering attacks related to an open port is decreased. The Dynamic packet filtering firewall can dynamically determine which data packets are allowed to pass links of an internal network and can dynamically obtain services of the application layer. And the Dynamic packet filtering firewall can configure a corresponding access policy, that is, a port is automatically open only within an allowed range and closed when the communication ends.
The Dynamic packet filtering firewall minimizes number of exposed ports in both directions and thus, provides better security to a network. The Dynamic IP packet filtering provides the most secure method for allocating ports dynamically to many application protocols, such as a media flow.
(3) Stateful Inspection
When performing a packet filtering, a Stateful Inspection firewall checks relevancy between/among data packets as well as state codes changing dynamically in the data packets. The Stateful Inspection firewall has an inspection engine which inspects each layer carrying out a network communication through a method of extracting related data. The inspection engine extracts state information and dynamically stores the state information as a reference for performing a security policy in the future. When a user access request reaches the operating system of a gateway, a state monitor extracts and analyses related data, and performs a processing action, such as admitting, rejecting, IDentification (ID) authentication, alarming or encrypting the communication, in combination with the network configuration and the security rules.
The Stateful Inspection firewall reserves a connection state table, regards data entering and leaving the network as sessions and uses the connection state table to track the state of each session. The state monitor checks each packet not only according to a rule table, but also considering whether the packet is in conformity with the state of the session. Thus, a comprehensive control of the transport layer is achieved. The mainstream firewalls in the market nowadays are Stateful Inspection firewalls in general. Although security of the Stateful Inspection firewall is improved to a certain extent, the Stateful Inspection firewall is not so satisfying in dealing with a Distributed Denial of Service (DDoS) attack, filtering of contents in the application layer and filtering of viruses.
(4) Deep Packet Inspection
The Deep Packet Inspection technology is combined with functions of invade detection and attack preventing. The Deep Packet Inspection technology can in-depth inspect a flow of information packets to find a vicious action and can search a known attack according to a feature detection and a content filtering. Moreover, the Deep Packet Inspection can identify what is “normal” communication and stops an abnormal access at the same time. A Deep Packet Inspection engine determines how to deal with a data packet based on technologies, such as a fingerprint matching, a heuristic technology, a malfunction detection and a statistical analysis. A Deep Packet Inspection firewall can effectively stop a DDoS attack, solve the problem of virus spread and the problem of advanced application invade.
Till now, the Application-proxy-based Firewall has also passed the evolvement from an Application Proxy firewall, a Circuit Proxy firewall to an Adaptation Proxy firewall.
The Application Proxy is also referred to as an Application Gateway. A proxy service is a dedicated application programme or a server programme running in a firewall host. The Application Proxy provides proxy to a special application service, resolves an application protocol and interprets commands of the application protocol.
The Application Proxy firewall can interpret an application protocol, support a subscriber authentication, and thus, can control data of the application layer with a finer granularity. The disadvantage of the Application Proxy firewall is that the efficiency is too low, no large scale concurrent connections can be supported, and only a single protocol is applicable.
The Application-proxy-based Firewall and the Packet-filter-based Firewall have been used widely in network security solutions. The Application-proxy-based Firewall and the Packet-filter-based Firewall may exist at the same time and filter data packets transmitted in the network in two layers, respectively.
In the NGN security solution and in a resource and admittance control framework being studied, only the Dynamic packet filtering can accept an open/close request from a session control proxy, that is, a Service Control Proxy Function (SCPF) controls open and close of the Dynamic packet filtering in a Border Gateway Function (BGF) through a Resource and Admittance Control Function (RACF), which is similar to the control and interaction between a proxy and a packet filtering in an Adaptation Proxy firewall device.
However, setting of the Static packet filtering, the Stateful Inspection and the Deep Packet Inspection in the NGN transport layer is performed by an administrator and can only be dealt with according to a coarse granularity security hierarchy configured by an operating policy. Moreover, the setting is invisible to the NGN service layer (including a session control proxy). In the case that a firewall provides packet filtering functions of different security levels, such as the static packet filtering, the dynamic packet filtering, the Stateful Inspection and the Deep Packet Inspection, at the same time, the firewall cannot dynamically select and execute a packet filtering function of different security levels according to a subscriber demand and a session type.